General
-
Target
9721a3aec263d78d2ba7d6739818dca2dea59cb63797a37abbbba6d210857aa5
-
Size
2.3MB
-
Sample
240527-aqql7she5z
-
MD5
1d7070198b11f8f874cb131e8661f744
-
SHA1
58d190cd05534276f3e8798ea4ff48c4f99a71d3
-
SHA256
9721a3aec263d78d2ba7d6739818dca2dea59cb63797a37abbbba6d210857aa5
-
SHA512
7e45e0a0fcfdfc30d690af35f0db65074153b85cb938590e9aff230239900c2ad9caf47dd7c42e0208163e46d75ba067d194a59c93b571381cebe373d30af537
-
SSDEEP
49152:2dmIppxHpoiSmqOB3s8BVMd1b8aysXDWDv99z:2sIpZoTgcYOtvQ99z
Static task
static1
Behavioral task
behavioral1
Sample
9721a3aec263d78d2ba7d6739818dca2dea59cb63797a37abbbba6d210857aa5.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
risepro
147.45.47.126:58709
Targets
-
-
Target
9721a3aec263d78d2ba7d6739818dca2dea59cb63797a37abbbba6d210857aa5
-
Size
2.3MB
-
MD5
1d7070198b11f8f874cb131e8661f744
-
SHA1
58d190cd05534276f3e8798ea4ff48c4f99a71d3
-
SHA256
9721a3aec263d78d2ba7d6739818dca2dea59cb63797a37abbbba6d210857aa5
-
SHA512
7e45e0a0fcfdfc30d690af35f0db65074153b85cb938590e9aff230239900c2ad9caf47dd7c42e0208163e46d75ba067d194a59c93b571381cebe373d30af537
-
SSDEEP
49152:2dmIppxHpoiSmqOB3s8BVMd1b8aysXDWDv99z:2sIpZoTgcYOtvQ99z
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-